<!DOCTYPE html>
<html>
  <head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8">
  <meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" name="viewport">
  <meta name="description" content="JinYan&#39;s blog">
  <meta name="keyword" content="hexo-theme, vuejs">
  
    <link rel="shortcut icon" href="/blog/css/images/logo.jpg">
  
  <title>
    
      wireshark-过滤器 | SanYuanEmpire
    
  </title>
  <link href="//cdn.bootcss.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet">
  <link href="//cdn.bootcss.com/nprogress/0.2.0/nprogress.min.css" rel="stylesheet">
  <link href="//cdn.bootcss.com/highlight.js/9.12.0/styles/tomorrow.min.css" rel="stylesheet">
  <link rel="stylesheet" href="/blog/css/style.css">
<link rel="stylesheet" href="/blog/css/plugins/gitment.css">
  <script src="//cdn.bootcss.com/jquery/3.2.1/jquery.min.js"></script>
  <script src="//cdn.bootcss.com/geopattern/1.2.3/js/geopattern.min.js"></script>
  <script src="//cdn.bootcss.com/nprogress/0.2.0/nprogress.min.js"></script>
  <script src="/blog/js/qrious.js"></script>
<script src="/blog/js/gitment.js"></script>
  
  
    <!-- MathJax support START -->
    <script type="text/x-mathjax-config">
      MathJax.Hub.Config({
        tex2jax: {
          inlineMath: [ ['$','$'], ["\\(","\\)"]  ],
          processEscapes: true,
          skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
        }
      });
    </script>

    <script type="text/x-mathjax-config">
      MathJax.Hub.Queue(function() {
        var all = MathJax.Hub.getAllJax(), i;
        for (i=0; i < all.length; i += 1) {
          all[i].SourceElement().parentNode.className += ' has-jax';
        }
      });
    </script>
    <script type="text/javascript" src="//cdn.bootcss.com/mathjax/2.7.1/latest.js?config=TeX-AMS-MML_HTMLorMML"></script>
    <!-- MathJax support END -->
  


</head>
<div class="wechat-share">
  <img src="/css/images/logo.jpg" />
</div>

  <body>
    <header class="header fixed-header">
  <div class="header-container">
    <a class="home-link" href="/blog/">
      <div class="logo"></div>
      <span>SanYuanEmpire</span>
    </a>
    <ul class="right-list">
      
        <li class="list-item">
          
            <a href="/blog/" class="item-link">Home</a>
          
        </li>
      
        <li class="list-item">
          
            <a href="/blog/archives/" class="item-link">Archives</a>
          
        </li>
      
    </ul>
    <div class="menu">
      <span class="icon-bar"></span>
      <span class="icon-bar"></span>
      <span class="icon-bar"></span>
    </div>
    <div class="menu-mask">
      <ul class="menu-list">
        
          <li class="menu-item">
            
              <a href="/blog/" class="menu-link">Home</a>
            
          </li>
        
          <li class="menu-item">
            
              <a href="/blog/archives/" class="menu-link">Archives</a>
            
          </li>
        
      </ul>
    </div>
  </div>
</header>

    <div id="article-banner">
  <h2>wireshark-过滤器</h2>
  <p class="post-date">2018-09-04</p>
  <div class="arrow-down">
    <a href="javascript:;"></a>
  </div>
</div>
<main class="app-body flex-box">
  <!-- Article START -->
  <article class="post-article">
    <section class="markdown-content"><h1 id="捕获"><a href="#捕获" class="headerlink" title="捕获"></a>捕获</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">host mail.163.com</span><br><span class="line">host www.qq.com</span><br></pre></td></tr></table></figure>
<h1 id="显示"><a href="#显示" class="headerlink" title="显示"></a>显示</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">bootp.option.dhcp_server_id == 10.3.3.3</span><br><span class="line">dns.qry.name == &quot;www.baidu.com&quot;</span><br><span class="line">tcp contains &quot;tzuchi&quot; or http contains &quot;tzuchi&quot;</span><br><span class="line">tcp.analysis.retransmission</span><br><span class="line">bootp.option.dhcp_server_id != 10.3.3.3 &amp;&amp; bootp.option.dhcp_server_id != 10.3.3.6</span><br><span class="line">dns.qry.name contains &quot;google&quot; or tcp contains &quot;google&quot; or http contains &quot;google&quot;</span><br><span class="line">dns.qry.name contains &quot;baidu&quot; or tcp contains &quot;baidu&quot; or http contains &quot;baidu&quot;</span><br><span class="line">dns.qry.name contains &quot;tzuchi&quot; or tcp contains &quot;tzuchi&quot; or http contains &quot;tzuchi&quot;</span><br><span class="line">dns.qry.name contains &quot;twitter&quot; or tcp contains &quot;twitter&quot; or http contains &quot;twitter&quot;</span><br><span class="line">tcp.dstport !=3389 &amp;&amp; tcp.srcport !=3389 &amp;&amp; ip.addr eq 10.3.3.3</span><br><span class="line">http.request.method == &quot;POST&quot;</span><br></pre></td></tr></table></figure>
<h1 id="几种条件操作符"><a href="#几种条件操作符" class="headerlink" title="几种条件操作符"></a>几种条件操作符</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"> == eq 等于 ip.addr == 192.168.0.1 ip.addr eq 192.168.0.1</span><br><span class="line">!= ne 不等于 !ip.addr==192.168.0.1 ip.addr!= 192.168.0.1 ip.addr ne 192.168.0.1</span><br><span class="line">&gt; gt 大于 frame.len&gt;64 frame.len gt 64</span><br><span class="line">&lt; lt 小于 frame.len&lt;1500 frame.len le 1500</span><br><span class="line">&gt;= ge 不大于 frame.len &gt;= 64</span><br><span class="line">&lt;= le 不小于 frame.len &lt;= 1500</span><br><span class="line">     is present 符合某项参数，满足某个条件，或者出现某个现象 http.response</span><br><span class="line">     contains 包含某个字符串 http.host contains cisco</span><br><span class="line">     match 某串字符匹配某个条件 http.host matches www.cicso.com</span><br></pre></td></tr></table></figure>
<h1 id="逻辑关系操作符"><a href="#逻辑关系操作符" class="headerlink" title="逻辑关系操作符"></a>逻辑关系操作符</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">    &amp;&amp; and 逻辑与 ip.src==10.0.0.1 and tcp.flags.syn=1</span><br><span class="line">     || or 逻辑或 ip.addr==10.0.0.1 or ip.addr==10.0.0.2 </span><br><span class="line">    ！ not 逻辑非 not arp and not icmp 除了 arp 和 icmp 之外的包</span><br><span class="line">ip.addr != 192.168.0.1 这样的表达式语法正确但是并不起作用，原因是每个 IP 数据包必定包含两个 IP 地址，wireshark 执行上边的过滤功能时，只要发现源和目的 IP 有一不为 192.168.0.1，就会判定条件为真，正确的应该是 !(ip.addr eq 192.168.0.1)</span><br></pre></td></tr></table></figure>
<h1 id="L2-显示过滤器"><a href="#L2-显示过滤器" class="headerlink" title="L2 显示过滤器"></a>L2 显示过滤器</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">eth.addr eq mac-address #显示指定 mac 地址的数据帧</span><br><span class="line">eth.src eq eth.dst eq #显示指定源和目的 mac 地址的数据帧</span><br><span class="line">e th.type eq protocol type (十六进制数，格式为 0xnnnn） #只显示特定以太网类型的流量</span><br><span class="line">arp.opcode eq value #只显示特定类型的 arp 帧，arp 按其所含代码字段值，可分为 arp 应答帧，响应帧，rarp 应答，响应帧 1=arp 请求 2=arp 应答 3=rarp 请求 4=rarp 应答</span><br><span class="line">arp.src.hw_mac eq mac address # 显示指定 mac 地址的主机发出的 arp 帧</span><br></pre></td></tr></table></figure>
<h1 id="常用的-ip-显示过滤器"><a href="#常用的-ip-显示过滤器" class="headerlink" title="常用的 ip 显示过滤器"></a>常用的 ip 显示过滤器</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">ip.addr eq ______ ip.src eq ip.dst eq </span><br><span class="line">ip.ttl eq value 只显示 ip 包头中 ttl 字段值为指定值的数据包</span><br><span class="line">ip.len = value # 只显示指定长度的 IP 数据包</span><br><span class="line">示例：</span><br><span class="line">      ip.dst eq 224.0.0.0/4 #可以加掩码</span><br></pre></td></tr></table></figure>
<h1 id="复杂的过滤器"><a href="#复杂的过滤器" class="headerlink" title="复杂的过滤器"></a>复杂的过滤器</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">ip.src eq 10.0.0.0/24 and http.host contains &quot;souhu&quot; # 显示 10.0.0.0/24 的主机，发往域名中包含指定字符串的所有 ip 流量。</span><br><span class="line">ip.addr eq 10.0.0.0/24 and http.host matches &quot;\.com$&quot; # 显示以. com 结尾的 ip 流量</span><br><span class="line">ip.src eq 10.0.0.0/24 and eth.dst eq ff:ff:ff:ff:ff:ff</span><br></pre></td></tr></table></figure>
<h1 id="TCP-UDP-过滤"><a href="#TCP-UDP-过滤" class="headerlink" title="TCP/UDP 过滤"></a>TCP/UDP 过滤</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line">tcp.port eq 或 udp.port eq  </span><br><span class="line">tcp.src/dst port udp 同理</span><br><span class="line">tcp.analysis 可用该参数来分析重传，重复确认，窗口大小有关的网络问题的参照物</span><br><span class="line">tcp.analysis.retransmission #显示重传的数据包</span><br><span class="line">tcp.analysis.duplicate_ack # 显示确认多次的 tcp 数据包</span><br><span class="line">tcp.analysis.zero_window # 显示零窗口通告信息的 tcp 数据包（tcp 会话一端的主机通过此类 tcp 数据包，向对端主机报告：本机 tcp 窗口为 0，请对方停止通过该会话发送数据</span><br><span class="line">tcp.flags.syn eq 1  </span><br><span class="line">tcp.flags.reset eq 1</span><br><span class="line">tcp.flags.fin eq 1</span><br><span class="line">tcp.window_size_value # 只显示 tcp 头部中窗口大小字段值低于指定值的数据包。可以排除与 tcp 窗口过小有关的性能问题，可以判定 tcp 参与 tcp 会话的网络设备反应过慢</span><br><span class="line">tcp.dstport eq 80 #显示到 http 服务器的流量</span><br><span class="line">ip.src eq 10.0.0.0/24 and tcp.srcport eq 80 #显示一个段的到 http 的流量</span><br><span class="line">tcp.stream eq 16 &amp;&amp; tcp.analysis.retransmission # 显示特定 TCP 连接（在抓包文件中编号 16 的连接）发生重传的所有 tcp 数据包。</span><br><span class="line">     追踪流功能可以显示某条 tcp 连接从建立到终止。</span><br><span class="line">     当分析重传，重复确认及其他影响网络性能的现象原因时，可以用 tcp.analysis 过滤参数及 follow tcp stream 把上述现象与具体的 tcp 连接建立起来。</span><br><span class="line">ip.src eq 10.0.0.5 &amp;&amp; udp.port eq 53 # 只显示 ip 地址的主机访问 dns 服务器的流量</span><br><span class="line">tcp contains &quot;windows&quot; # 只显示包含搜索关键字 “windows” 的 tcp 数据包，区分大小写。</span><br><span class="line">tcp.stream eq 0 &amp;&amp;(tcp.analysis.window_full ||/or tcp.analysis.zero_window) #显示某条特定 tcp 连接中出现窗口问题的 tcp 数据包</span><br><span class="line">ip.src eq 10.0.0.3 &amp;&amp; (http.cookie||http.set_cookie) # 显示指定主机发送的包含 http cookie 的所有数据包</span><br></pre></td></tr></table></figure>
<h1 id="http-过滤"><a href="#http-过滤" class="headerlink" title="http 过滤"></a>http 过滤</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">http.host eq &quot;hostname&quot; #显示访问指定主机的 http 协议数据包</span><br><span class="line">http.request.method eq &quot;get&quot; # 显示 http get 方法的数据包</span><br><span class="line">http.request.uri eq &quot;xxxx.com&quot; # 显示指定 uri 请求的包</span><br><span class="line">http.request.uri contains &quot;mail.google.com&quot; # 显示包含字符串 mail.google.comd uri 请求数据包</span><br><span class="line">http.cookie # 显示包含 cookie 请求的数据包，cookie 总是从 http 客户端发往 http 服务器</span><br><span class="line">http.set_cookie # 显示传播的所有包含由 http 服务器发送给 http 客户端的 cookie set 命令的 http 包</span><br><span class="line">http matches &quot;\.zip&quot; &amp;&amp; http.request.method eq &quot;get&quot; # 显示包含 zip 文件的 http 数据包</span><br></pre></td></tr></table></figure>
<h1 id="DNS"><a href="#DNS" class="headerlink" title="DNS"></a>DNS</h1><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">dns.flags.response eq 0 #DNS 查询</span><br><span class="line">dns.flags.response eq 1 #dns 响应</span><br><span class="line">dns.count.answers &gt;= 4 # 显示所有 anser count 字段值大于或等于 4 的 dns 响应数据包</span><br></pre></td></tr></table></figure>
</section>
    <!-- Tags START -->
    
    <!-- Tags END -->
    <!-- NAV START -->
    
  <div class="nav-container">
    <!-- reverse left and right to put prev and next in a more logic postition -->
    
      <a class="nav-left" href="/blog/2018/09/04/Linux命令-nmap/">
        <span class="nav-arrow">← </span>
        
          Linux命令-nmap
        
      </a>
    
    
      <a class="nav-right" href="/blog/2018/09/04/Windows-远程桌面默认端口更改/">
        
          Windows-远程桌面默认端口更改
        
        <span class="nav-arrow"> →</span>
      </a>
    
  </div>

    <!-- NAV END -->
    
      <!-- No Comment -->
    
  </article>
  <!-- Article END -->
  <!-- Catalog START -->
  
    <aside class="catalog-container">
  <div class="toc-main">
    <strong class="toc-title">Catalog</strong>
    
      <ol class="toc-nav"><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#捕获"><span class="toc-nav-text">捕获</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#显示"><span class="toc-nav-text">显示</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#几种条件操作符"><span class="toc-nav-text">几种条件操作符</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#逻辑关系操作符"><span class="toc-nav-text">逻辑关系操作符</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#L2-显示过滤器"><span class="toc-nav-text">L2 显示过滤器</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#常用的-ip-显示过滤器"><span class="toc-nav-text">常用的 ip 显示过滤器</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#复杂的过滤器"><span class="toc-nav-text">复杂的过滤器</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#TCP-UDP-过滤"><span class="toc-nav-text">TCP/UDP 过滤</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#http-过滤"><span class="toc-nav-text">http 过滤</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#DNS"><span class="toc-nav-text">DNS</span></a></li></ol>
    
  </div>
</aside>
  
  <!-- Catalog END -->
</main>

<script>
  (function () {
    var url = 'git@gitee.com:sanyuanempire/blog.git/2018/09/04/wireshark-过滤器/';
    var banner = ''
    if (banner !== '' && banner !== 'undefined' && banner !== 'null') {
      $('#article-banner').css({
        'background-image': 'url(' + banner + ')'
      })
    } else {
      $('#article-banner').geopattern(url)
    }
    $('.header').removeClass('fixed-header')

     // error image
    $(".markdown-content img").on('error', function() {
      $(this).attr('src', 'http://file.muyutech.com/error-img.png')
      $(this).css({
        'cursor': 'default'
      })
    })

    // zoom image
    $(".markdown-content img").on('click', function() {
      var src = $(this).attr('src')
      if (src !== 'http://file.muyutech.com/error-img.png') {
        var imageW = $(this).width()
        var imageH = $(this).height()
        
        var zoom = ($(window).width() * 0.95 / imageW).toFixed(2)
        zoom = zoom < 1 ? 1 : zoom
        zoom = zoom > 2 ? 2 : zoom
        var transY = (($(window).height() - imageH) / 2).toFixed(2)

        $('body').append('<div class="image-view-wrap"><div class="image-view-inner"><img src="'+ src +'" /></div></div>')
        $('.image-view-wrap').addClass('wrap-active')
        $('.image-view-wrap img').css({
          'width': `${imageW}`,
          'transform': `translate3d(0, ${transY}px, 0) scale3d(${zoom}, ${zoom}, 1)`
        })
        $('html').css('overflow', 'hidden')

        $('.image-view-wrap').on('click', function() {
          $(this).remove()
          $('html').attr('style', '')
        })
      }
    })

    // qrcode
    var qr = new QRious({
      element: document.getElementById('share-qrcode'),
      value: document.location.href
    });

    // gitment
    var gitmentConfig = "";
    if (gitmentConfig !== 'undefined') {
      var gitment = new Gitment({
        id: "wireshark-过滤器",
        owner: "",
        repo: "",
        oauth: {
          client_id: "",
          client_secret: ""
        },
        theme: {
          render(state, instance) {
            const container = document.createElement('div')
            container.lang = "en-US"
            container.className = 'gitment-container gitment-root-container'
            container.appendChild(instance.renderHeader(state, instance))
            container.appendChild(instance.renderEditor(state, instance))
            container.appendChild(instance.renderComments(state, instance))
            container.appendChild(instance.renderFooter(state, instance))
            return container;
          }
        }
      })
      gitment.render(document.getElementById('comments'))
    }
  })();
</script>

<script>
  var disqus_shortname = '';
  
  var disqus_url = 'git@gitee.com:sanyuanempire/blog.git/2018/09/04/wireshark-过滤器/';
  
  (function(){
    var dsq = document.createElement('script');
    dsq.type = 'text/javascript';
    dsq.async = true;
    dsq.src = '//go.disqus.com/embed.js';
    (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
  })();
</script>

    <div class="scroll-top">
  <span class="arrow-icon"></span>
</div>
    <footer class="app-footer">
  <p class="copyright">
    &copy; 2018 | Proudly powered by <a href="https://sanyuanempire.gitee.io/blog" target="_blank">JinYan</a>
    <br>
    Theme by <a href="https://sanyuanempire.gitee.io/blog">JinYan</a>
  </p>
</footer>

<script>
  function async(u, c) {
    var d = document, t = 'script',
      o = d.createElement(t),
      s = d.getElementsByTagName(t)[0];
    o.src = u;
    if (c) { o.addEventListener('load', function (e) { c(null, e); }, false); }
    s.parentNode.insertBefore(o, s);
  }
</script>
<script>
  async("//cdn.bootcss.com/fastclick/1.0.6/fastclick.min.js", function(){
    FastClick.attach(document.body);
  })
</script>

<script>
  var hasLine = 'true';
  async("//cdn.bootcss.com/highlight.js/9.12.0/highlight.min.js", function(){
    $('figure pre').each(function(i, block) {
      var figure = $(this).parents('figure');
      if (hasLine === 'false') {
        figure.find('.gutter').hide();
      }
      var lang = figure.attr('class').split(' ')[1] || 'code';
      var codeHtml = $(this).html();
      var codeTag = document.createElement('code');
      codeTag.className = lang;
      codeTag.innerHTML = codeHtml;
      $(this).attr('class', '').empty().html(codeTag);
      figure.attr('data-lang', lang.toUpperCase());
      hljs.highlightBlock(block);
    });
  })
</script>
<!-- Baidu Tongji -->

<script src="/blog/js/script.js"></script>

  </body>
</html>